github.com/gin-gonic/gin (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/gin-gonic/gin, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (5)

• CVE-2019-25211 — CVSS 9.1 (critical): parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g…
• CVE-2020-36567 — CVSS 7.5 (high): Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.
• CVE-2020-28483 — CVSS 7.1 (high): This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed…
• CVE-2023-26125 — CVSS 5.6 (medium): Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a…
• CVE-2023-29401 — CVSS 4.3 (medium): The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the…